deadsimple BSD Security Advisories and Announcements

OpenSMTPD 7.4.0p0 Released

OpenSMTPD is a FREE implementation of the SMTP protocol with some common
extensions. It allows ordinary machines to exchange e-mails with systems
speaking the SMTP protocol. It implements a fairly large part of RFC5321
and can already cover a large range of use-cases.

It runs on OpenBSD, NetBSD, FreeBSD, DragonFlyBSD, Linux and OSX.

The archives are now available from the main site at

We would like to thank the OpenSMTPD community for their help in testing
the snapshots, reporting bugs, contributing code and packaging for other

This is a major release with multiple bug fixes.

Dependencies note:

This release builds with LibreSSL, or OpenSSL > 1.1.1 optionally with

It's preferable to depend on LibreSSL as OpenSMTPD is written and tested
with that dependency. OpenSSL library is considered as a best effort
target TLS library and provided as a commodity, LibreSSL has become our
target TLS library.

Changes in this release:

- Avoid truncation of filtered data lines.
  Lines in the email body passed through a filter were truncated to
  roughly LINE_MAX bytes.

- Allow arguments on NOOP.

- Swap link-auth filter arguments and bump filter protocol version.
  It was ambiguous in the case the user name would contain a '|'

- Add Message-ID as needed for messages received on the submission port.
  This was dropped during the incoming message parser refactor in 2018.

- Drop ENGINE support.

- Updated the bundled copy of libtls.
  This includes the removal of the support for TLS v1.0 and 1.1 as they
  were "MUST NOT use" for more than two years already.

The neverending cleanup of the -portable layer continued.  This
includes the complete rework of some parts:

- Rework of the configure script:
  + better checks for libraries using AC_SEARCH_LIBS
  + dropped some useless and/or redundant checks
  + better checks for functions, shouldn't yield false-positives
  + various simplification to the -portable layer thanks to these

- Simplified the `bootstrap` script.


  SHA256 (opensmtpd-7.4.0p0.tar.gz)   c181ccc3434a11e583619e00028520d457fe062e34dc03beea358078220ce374


Starting with version 5.7.1, releases are signed with signify(1).

You can obtain the public key from our website, check with our community
that it has not been altered on its way to your machine.

   $ wget

Once you are confident the key is correct, you can verify the release as
described below:

1- download both release tarball and matching signature file to same directory:

   $ wget
   $ wget

2- use `signify` to verify that signature file is properly signed and that the
   checksum matches the release tarball you downloaded:

   for portable version:
   $ signify -C -e -p -x opensmtpd-7.4.0p0.sum.sig
   Signature Verified
   opensmtpd-7.4.0p0.tar.gz: OK

If you don't get an OK message, then something is not right and you should not
install without first understanding why it failed.


You are encouraged to register to our general purpose mailing-list:

The "Official" IRC channel for the project is at:
    #opensmtpd @

Support us:

The project is maintained by volunteers, you can support us by:

- donating time to help test development branch during development cycle
- donating money to either one of the OpenBSD or OpenSMTPD project
- sponsoring developers through direct donations or patreon
- sponsoring developers through contracts to write features

Get in touch with us by e-mail or on IRC for more informations.

Reporting Bugs:

Please read
Security bugs should be reported directly to
Other bugs may be reported to